Question

Contoso has deployed Global Secure Access with the Microsoft 365 traffic forwarding profile and the Internet Access profile enabled on all corporate Windows devices. The security team wants to ensure that employees can only sign in to Contoso's own Microsoft 365 tenant from these managed devices and cannot authenticate to any external or personal Microsoft 365 tenants, even when using web browsers. The solution must apply automatically based on the device's Global Secure Access connectivity and must not require configuring proxy headers on each device manually. What should you configure?

Accepted Answer

Enable universal tenant restrictions in the Global Secure Access cross-tenant access settings so tenant restriction v2 signals are injected into traffic through the Internet Access profile

Answer

Create a Conditional Access policy that blocks access for all users when the sign-in comes from an unmanaged device

Answer

Configure a Private Access application segment that publishes the Microsoft 365 sign-in endpoints internally

Answer

Add the corporate tenant to the allowed list in the outbound cross-tenant access settings and rely on B2B collaboration defaults